d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bound check for broken Configuration ROM.

Browse Source
This commit is contained in:
Hidetoshi Shimokawa 2003-06-16 08:43:22 +00:00
parent 62cc1e0584
commit 88e7cb59f4
1 changed files with 19 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
sys/dev/firewire/fwcrom.c
View File

@ -52,6 +52,9 @@
#include <dev/firewire/firewire.h>
#include <dev/firewire/iec13213.h>
#define MAX_ROM (1024 - sizeof(u_int32_t) * 5)
#define CROM_END(cc) ((vm_offset_t)(cc)->stack[0].dir + MAX_ROM - 1)
void
crom_init_context(struct crom_context *cc, u_int32_t *p)
{
@ -93,12 +96,12 @@ crom_next(struct crom_context *cc)
return;
reg = crom_get(cc);
if ((reg->key & CSRTYPE_MASK) == CSRTYPE_D) {
cc->depth ++;
if (cc->depth > CROM_MAX_DEPTH) {
if (cc->depth >= CROM_MAX_DEPTH) {
printf("crom_next: too deep\n");
cc->depth --;
goto again;
}
cc->depth ++;
ptr = &cc->stack[cc->depth];
ptr->dir = (struct csrdirectory *) (reg + reg->val);
ptr->index = 0;
@ -108,8 +111,13 @@ crom_next(struct crom_context *cc)
ptr = &cc->stack[cc->depth];
ptr->index ++;
check:
if (ptr->index < ptr->dir->crc_len)
if (ptr->index < ptr->dir->crc_len &&
(vm_offset_t)crom_get(cc) <= CROM_END(cc))
return;
if (ptr->index < ptr->dir->crc_len)
printf("crom_next: bound check failed\n");
if (cc->depth > 0) {
cc->depth--;
goto again;
@ -173,12 +181,18 @@ crom_parse_text(struct crom_context *cc, char *buf, int len)
return;
reg = crom_get(cc);
if (reg->key != CROM_TEXTLEAF) {
if (reg->key != CROM_TEXTLEAF ||
(vm_offset_t)(reg + reg->val) > CROM_END(cc)) {
strncpy(buf, nullstr, len);
return;
}
textleaf = (struct csrtext *)(reg + reg->val);
if ((vm_offset_t)textleaf + textleaf->crc_len > CROM_END(cc)) {
strncpy(buf, nullstr, len);
return;
}
/* XXX should check spec and type */
bp = (u_int32_t *)&buf[0];